Good technology decisions start with a clear problem and a realistic view of the work involved. This guide sets out the questions we would bring into a discovery conversation, the tradeoffs to examine and the evidence worth collecting before committing to a delivery plan. The aim is practical clarity for Australian product teams and business owners.
Separate current obligations from proposed reform
Privacy requirements change, and summaries can blur enacted law, commencement dates and proposals. Treat this article as an engineering planning guide rather than an interpretation of your legal obligations. Use the Office of the Australian Information Commissioner and current legislation as primary references, and obtain advice appropriate to your organisation before relying on a compliance position.
For a roadmap discussion, prepare a short change register rather than a broad declaration that the product is “compliant”. Each entry should name an authoritative source, the relevant commencement position, the adviser responsible for interpreting it and the engineering work that follows. Revisit the register when the advice changes. This keeps a draft proposal or an old article from quietly becoming the basis for a production decision.
Map the personal information you handle
Create a practical inventory covering collection points, business purposes, storage, access, processors, exports and deletion. Include support tools, analytics, logs and test environments, which are often missed in a product-level diagram. Assign an owner to each flow. An accurate inventory helps your privacy adviser assess obligations and helps engineers implement changes without guessing where the information has travelled.
Trace one ordinary enquiry from the browser through the form handler, mailbox, customer-management tool and backup process. Then trace an attachment and an analytics event separately. The routes may differ. Record where deletion is possible and where an operational process is needed. A real example often exposes a forgotten copy of information more quickly than reviewing a high-level architecture diagram alone.
Turn privacy decisions into delivery requirements
Translate approved policy decisions into acceptance criteria. A retention rule should specify the records affected, exceptions, deletion mechanism and evidence of completion. A consent interface should record the version of the notice the person saw. Avoid putting the entire burden on a policy page; controls need to exist in the software and operational processes as well.
Use a concrete requirement such as “remove this category of record after the approved retention period, unless a documented exception applies”. Define how the exception is recorded, who approves it and how the deletion is verified. Test against realistic records in a controlled environment. The technical solution should follow an approved policy decision rather than leaving an engineer to invent the retention rule during implementation.
Review suppliers and cross-border flows
Document which suppliers receive personal information, the services they provide and the available configuration controls. Hosting in an Australian region is only one part of the picture: support access, telemetry, backups and subprocessors may have different arrangements. Work with your privacy and procurement advisers to determine what is acceptable for your use case and how those decisions should be recorded.
Ask suppliers for the information your advisers need, and keep the response with the decision record. Distinguish a provider’s general marketing statement from the configuration and contract that apply to your account. Review changes to subprocessors and services through the same ownership process used for other material product changes. The aim is a traceable decision, not a collection of badges on a procurement checklist.
Prepare for requests and incidents
Make it possible to locate relevant records, manage access and correction requests, and investigate suspected incidents. Rehearse the workflow with operational staff, including a situation where a supplier is unavailable. Keep incident decision-making responsibilities clear. Technical teams should preserve useful evidence while avoiding unnecessary copies of sensitive information during investigation.
Rehearse a request using a test identity whose information appears in several systems. Can staff find the records, verify the request appropriately and explain what happens next? For an incident exercise, check who can contact suppliers and who makes notification decisions. Keep the exercise proportionate and avoid introducing real personal information merely to make the test feel realistic.
Build an ongoing review rhythm
Review your information inventory when features, suppliers or data uses change. Subscribe to authoritative updates and assign someone to distinguish a proposed change from a commenced obligation. Privacy work is more manageable when it is part of ordinary design and release decisions. Keep a record of advice, implementation choices and verification evidence so future teams understand why controls exist.
Add a privacy review question to design and release templates: does this change collect new information, change an audience, add a supplier or introduce a new use? A “yes” should bring the appropriate owner into the discussion early. Small checks embedded in ordinary delivery are easier to sustain than a large review that happens only when a product is about to launch.
Bring the right questions to the table
Before choosing a supplier or solution, write a short decision brief. Describe the outcome you need, the constraints you cannot change and the assumptions you can test. Ask your team to review it from the perspective of customers, operations and ongoing ownership. Differences in those perspectives are useful: they often reveal an overlooked requirement before it becomes expensive to change.
You do not need a perfect specification to begin a conversation. You do need a shared understanding of the next decision. BonsaiCo can help frame a discovery engagement, work through options and prepare a practical delivery plan. Start small, make the work visible and let evidence guide the next stage of growth.
Primary references
OAIC Australian Privacy Principles guidelines. Confirm the current position with your privacy adviser.